feat(zgw): real per-request identity seam + citizen-scoping (WP-53)

Replaces the hardcoded DocumentStore.DemoOwner and the static ZgwOptions
UserId/UserRepresentation with one per-request CallerIdentity, resolved by a
pluggable IIdentityProvider (StubIdentityProvider reads X-Role/X-Subject
today; a real OIDC/DigiD provider swaps in without touching any consumer).

- Domain/Authorization/{CallerIdentity,IIdentityProvider,StubIdentityProvider}.cs
  + a resolution middleware in Program.cs, right after correlation-id.
- Authz.ResolvePrincipal(ctx) keeps its signature (now reads ctx.Caller().Role),
  so its ~15 call sites needed no changes.
- Every endpoint that passed DocumentStore.DemoOwner to a store now passes
  ctx.Caller().Bsn.
- ZgwTokenProvider gains Mint(CallerIdentity) alongside the original Mint()
  (kept for calls not tied to one citizen); ZgwHttpClient threads an optional
  caller through to pick the right overload.
- IZaakSource gains ListMyCases(caller, now) — the citizen-scoped read
  OpenZaakZaakSource backs with ZGW's rol__...__inpBsn filter. GET /applications
  now routes through it instead of ApplicationStore directly, closing the last
  "reads a static store" gap for a citizen-facing endpoint.

Backend 159/159 tests (+8, incl. an HTTP-level two-identity scoping proof),
npm run ci green, no api-client drift.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/tests/BigRegister.Tests/StubIdentityProviderTests.cs

@@ -0,0 +1,43 @@
+using BigRegister.Api.Data;
+using BigRegister.Domain.Authorization;
+using Microsoft.AspNetCore.Http;
+
+namespace BigRegister.Tests;
+
+/// WP-53: the dev stub identity provider — role from X-Role (unchanged behaviour), subject BSN
+/// from the new X-Subject header, defaulting to the single seeded citizen so every existing
+/// request (none of which send X-Subject) resolves exactly as before this WP.
+public class StubIdentityProviderTests
+{
+  private static CallerIdentity Resolve(string? role, string? subject)
+  {
+    var ctx = new DefaultHttpContext();
+    if (role is not null) ctx.Request.Headers["X-Role"] = role;
+    if (subject is not null) ctx.Request.Headers["X-Subject"] = subject;
+    return new StubIdentityProvider().Resolve(ctx);
+  }
+
+  [Fact]
+  public void No_headers_resolves_to_the_seeded_citizen_as_a_drafter()
+  {
+    var caller = Resolve(role: null, subject: null);
+    Assert.Equal(DocumentStore.DemoOwner, caller.Bsn);
+    Assert.Equal(PrincipalRole.Drafter, caller.Role);
+  }
+
+  [Theory]
+  [InlineData("approver", PrincipalRole.Approver)]
+  [InlineData("admin", PrincipalRole.Admin)]
+  [InlineData("something-unknown", PrincipalRole.Drafter)]
+  public void X_role_maps_to_the_principal_role(string header, PrincipalRole expected)
+  {
+    Assert.Equal(expected, Resolve(header, subject: null).Role);
+  }
+
+  [Fact]
+  public void X_subject_overrides_the_default_bsn()
+  {
+    var caller = Resolve(role: null, subject: "999888777");
+    Assert.Equal("999888777", caller.Bsn);
+  }
+}